Improper Access Control in MediaTek products - CVE-2024-20065
Published: June 4, 2024
Vulnerability identifier: #VU91036
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-20065
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: MediaTek
Affected software:
MT6768
MT6835
MT6855
MT6879
MT6886
MT6983
MT6985
MT6989
MT6781
MT6853
MT6877
MT6885
MT6893
MT6768
MT6835
MT6855
MT6879
MT6886
MT6983
MT6985
MT6989
MT6781
MT6853
MT6877
MT6885
MT6893
Detailed vulnerability description
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a missing permission check within telephony. A local application can gain access to sensitive information.
How to mitigate CVE-2024-20065
Install security update from vendor's website.